@oxyhq/core 3.10.1 → 3.12.0

package/src/crypto/__tests__/canonicalJson.test.ts

@@ -0,0 +1,116 @@
+/**
+ * Canonical JSON tests.
+ *
+ * The whole point of `canonicalize` is that two structurally-equal values
+ * produce identical strings regardless of how their keys were ordered, so a
+ * client which signs and a server which verifies agree on the signing input.
+ * These tests pin that determinism, the array-order guarantee, the nesting
+ * behaviour, and the JSON value/omit semantics.
+ */
+
+import { canonicalize } from '../canonicalJson';
+
+describe('canonicalize', () => {
+  describe('object key ordering', () => {
+    it('produces identical output regardless of insertion order', () => {
+      const a = canonicalize({ b: 1, a: 2, c: 3 });
+      const b = canonicalize({ c: 3, a: 2, b: 1 });
+      const c = canonicalize({ a: 2, b: 1, c: 3 });
+      expect(a).toBe(b);
+      expect(b).toBe(c);
+      expect(a).toBe('{"a":2,"b":1,"c":3}');
+    });
+
+    it('sorts keys recursively at every level', () => {
+      const value = {
+        z: { y: 1, x: 2 },
+        a: { c: 3, b: { e: 5, d: 4 } },
+      };
+      expect(canonicalize(value)).toBe(
+        '{"a":{"b":{"d":4,"e":5},"c":3},"z":{"x":2,"y":1}}',
+      );
+    });
+
+    it('is order-insensitive across deep nesting', () => {
+      const first = canonicalize({
+        outer: { inner: { p: 1, q: 2 }, lead: 'x' },
+        meta: { issuedAt: 10, version: 1 },
+      });
+      const second = canonicalize({
+        meta: { version: 1, issuedAt: 10 },
+        outer: { lead: 'x', inner: { q: 2, p: 1 } },
+      });
+      expect(first).toBe(second);
+    });
+  });
+
+  describe('array ordering', () => {
+    it('preserves array element order (never sorts arrays)', () => {
+      expect(canonicalize([3, 1, 2])).toBe('[3,1,2]');
+      expect(canonicalize(['b', 'a', 'c'])).toBe('["b","a","c"]');
+    });
+
+    it('distinguishes arrays that differ only in order', () => {
+      expect(canonicalize([1, 2])).not.toBe(canonicalize([2, 1]));
+    });
+
+    it('canonicalizes objects inside arrays without reordering the array', () => {
+      const value = [
+        { b: 1, a: 2 },
+        { d: 3, c: 4 },
+      ];
+      expect(canonicalize(value)).toBe('[{"a":2,"b":1},{"c":4,"d":3}]');
+    });
+  });
+
+  describe('primitives', () => {
+    it('serializes null, booleans, strings and numbers as JSON', () => {
+      expect(canonicalize(null)).toBe('null');
+      expect(canonicalize(true)).toBe('true');
+      expect(canonicalize(false)).toBe('false');
+      expect(canonicalize('hi')).toBe('"hi"');
+      expect(canonicalize(42)).toBe('42');
+      expect(canonicalize(-1.5)).toBe('-1.5');
+      expect(canonicalize(0)).toBe('0');
+    });
+
+    it('escapes strings the same way JSON does', () => {
+      expect(canonicalize('a"b\\c\n')).toBe(JSON.stringify('a"b\\c\n'));
+    });
+  });
+
+  describe('JSON value/omit semantics', () => {
+    it('omits object properties whose value is undefined', () => {
+      expect(canonicalize({ a: 1, b: undefined, c: 3 })).toBe('{"a":1,"c":3}');
+    });
+
+    it('renders undefined array elements as null (preserving length)', () => {
+      expect(canonicalize([1, undefined, 3])).toBe('[1,null,3]');
+    });
+
+    it('respects toJSON (Date and its ISO string canonicalize identically)', () => {
+      const date = new Date('2026-06-26T00:00:00.000Z');
+      expect(canonicalize(date)).toBe(JSON.stringify(date.toISOString()));
+      expect(canonicalize({ at: date })).toBe(
+        canonicalize({ at: '2026-06-26T00:00:00.000Z' }),
+      );
+    });
+  });
+
+  describe('rejects values outside the JSON data model', () => {
+    it('throws on non-finite numbers', () => {
+      expect(() => canonicalize(NaN)).toThrow();
+      expect(() => canonicalize(Infinity)).toThrow();
+      expect(() => canonicalize({ x: Infinity })).toThrow();
+    });
+
+    it('throws on bigint', () => {
+      expect(() => canonicalize(BigInt(1))).toThrow();
+    });
+
+    it('throws on a bare undefined / function at the top level', () => {
+      expect(() => canonicalize(undefined)).toThrow();
+      expect(() => canonicalize(() => 1)).toThrow();
+    });
+  });
+});

package/src/crypto/__tests__/keyManager.atomicity.test.ts

@@ -21,7 +21,7 @@ import { setPlatformOS } from '../../utils/platform';
 // Fault-injectable in-memory secure store. `failPlan` lets a test make a
 // specific (op, key) pair throw to simulate a keychain that fails mid-write or
 // is transiently locked.
-const failPlan: { failKey?: string; failOp?: 'set' | 'get' } = {};
+const failPlan: { failKey?: string; failOp?: 'set' | 'get'; failTimes?: number } = {};
 
 jest.mock(
   'expo-secure-store',
@@ -29,6 +29,14 @@ jest.mock(
     const store = new Map<string, string>();
     const maybeFail = (op: 'set' | 'get', key: string) => {
       if (failPlan.failOp === op && failPlan.failKey === key) {
+        if (failPlan.failTimes !== undefined) {
+          failPlan.failTimes -= 1;
+          if (failPlan.failTimes <= 0) {
+            failPlan.failKey = undefined;
+            failPlan.failOp = undefined;
+            failPlan.failTimes = undefined;
+          }
+        }
         throw new Error(`Simulated ${op} failure for ${key}`);
       }
     };
@@ -51,6 +59,7 @@ jest.mock(
         store.clear();
         failPlan.failKey = undefined;
         failPlan.failOp = undefined;
+        failPlan.failTimes = undefined;
       },
       __getStore__: () => store,
       __failPlan__: failPlan,
@@ -92,7 +101,7 @@ jest.mock('../../utils/platformCrypto', () => ({
 interface SecureStoreTestHandle {
   __resetStore__: () => void;
   __getStore__: () => Map<string, string>;
-  __failPlan__: { failKey?: string; failOp?: 'set' | 'get' };
+  __failPlan__: { failKey?: string; failOp?: 'set' | 'get'; failTimes?: number };
 }
 
 describe('KeyManager atomicity & recoverability under flaky storage', () => {
@@ -146,6 +155,36 @@ describe('KeyManager atomicity & recoverability under flaky storage', () => {
     expect(m.get('oxy_identity_backup_public_key')).toBe(originalPublic);
   });
 
+  it('a failed final backup refresh rejects and rolls back instead of succeeding with a stale backup', async () => {
+    const originalPublic = await KeyManager.createIdentity();
+    const ss = (await import('expo-secure-store' as string)) as unknown as SecureStoreTestHandle;
+    const originalPriv = ss.__getStore__().get('oxy_identity_private_key');
+    resetCaches();
+
+    // Let the new primary write and verify, then fail exactly once while
+    // refreshing the backup to the new identity. This used to return success
+    // with primary=B and backup=A, enabling a later absent-primary restore to
+    // silently switch back to A.
+    ss.__failPlan__.failOp = 'set';
+    ss.__failPlan__.failKey = 'oxy_identity_backup_public_key';
+    ss.__failPlan__.failTimes = 1;
+    await expect(KeyManager.createIdentity({ overwrite: true })).rejects.toBeDefined();
+
+    resetCaches();
+
+    // The operation failed atomically: primary and backup both still identify
+    // the original account, so callers cannot observe success with a stale
+    // cross-account backup.
+    expect(await KeyManager.hasIdentity()).toBe(true);
+    expect(await KeyManager.getPublicKey()).toBe(originalPublic);
+    const m = ss.__getStore__();
+    expect(m.get('oxy_identity_private_key')).toBe(originalPriv);
+    expect(m.get('oxy_identity_public_key')).toBe(originalPublic);
+    expect(m.get('oxy_identity_backup_private_key')).toBe(originalPriv);
+    expect(m.get('oxy_identity_backup_public_key')).toBe(originalPublic);
+  });
+
+
   it('restoreIdentityFromBackup does NOT clobber a healthy primary that is only transiently unreadable', async () => {
     const original = await KeyManager.createIdentity();
     const ss = (await import('expo-secure-store' as string)) as unknown as SecureStoreTestHandle;

package/src/crypto/__tests__/signChallengeShared.test.ts

@@ -0,0 +1,64 @@
+/**
+ * `signChallengeWithSharedKey` tests.
+ *
+ * Verifies the shared-key challenge signer mirrors `signChallenge` exactly —
+ * same `auth:${publicKey}:${challenge}:${timestamp}` message format so the
+ * server verification path is unchanged — but sources the SHARED key from
+ * `KeyManager` (not the primary device key). We mock the shared key access with
+ * a REAL elliptic secp256k1 keypair so signing/verification is genuine.
+ */
+
+import { ec as EC } from 'elliptic';
+import { KeyManager } from '../keyManager';
+import { SignatureService } from '../signatureService';
+
+const ec = new EC('secp256k1');
+
+describe('SignatureService.signChallengeWithSharedKey', () => {
+  const sharedKeyPair = ec.genKeyPair();
+  const sharedPublicKey = sharedKeyPair.getPublic('hex');
+  const sharedPrivateKey = sharedKeyPair.getPrivate('hex');
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it('signs with the shared key and uses the unchanged message format', async () => {
+    jest.spyOn(KeyManager, 'getSharedPublicKey').mockResolvedValue(sharedPublicKey);
+    jest.spyOn(KeyManager, 'getSharedPrivateKey').mockResolvedValue(sharedPrivateKey);
+    // Guard: it must NOT fall back to the primary device key.
+    const primarySpy = jest.spyOn(KeyManager, 'getPublicKey');
+
+    const result = await SignatureService.signChallengeWithSharedKey('chal-123');
+
+    expect(result.publicKey).toBe(sharedPublicKey);
+    expect(typeof result.challenge).toBe('string'); // the signature
+    expect(typeof result.timestamp).toBe('number');
+    expect(primarySpy).not.toHaveBeenCalled();
+
+    // The signature verifies against the SAME message format `signChallenge`
+    // uses, proving the format is unchanged and the shared key signed it.
+    const message = `auth:${sharedPublicKey}:chal-123:${result.timestamp}`;
+    await expect(
+      SignatureService.verify(message, result.challenge, sharedPublicKey),
+    ).resolves.toBe(true);
+  });
+
+  it('throws when no shared identity exists', async () => {
+    jest.spyOn(KeyManager, 'getSharedPublicKey').mockResolvedValue(null);
+    jest.spyOn(KeyManager, 'getSharedPrivateKey').mockResolvedValue(null);
+
+    await expect(
+      SignatureService.signChallengeWithSharedKey('chal-123'),
+    ).rejects.toThrow(/No shared identity/);
+  });
+
+  it('throws when the shared private key is missing even if the public key is present', async () => {
+    jest.spyOn(KeyManager, 'getSharedPublicKey').mockResolvedValue(sharedPublicKey);
+    jest.spyOn(KeyManager, 'getSharedPrivateKey').mockResolvedValue(null);
+
+    await expect(
+      SignatureService.signChallengeWithSharedKey('chal-123'),
+    ).rejects.toThrow(/No shared identity/);
+  });
+});

package/src/crypto/__tests__/signedRecord.test.ts

@@ -0,0 +1,345 @@
+/**
+ * Signed-record envelope tests.
+ *
+ * Exercises the full client-side path: `SignatureService.signRecord` builds an
+ * envelope whose signature covers the canonical JSON of every field EXCEPT
+ * `publicKey`/`signature`, and `SignatureService.verifyRecord` round-trips it.
+ * We mock `KeyManager`'s key access with a REAL elliptic secp256k1 keypair, so
+ * the signing/verification is genuine cryptography (not a stub).
+ */
+
+import { ec as EC } from 'elliptic';
+import type { SignedRecordEnvelope } from '@oxyhq/contracts';
+import { KeyManager } from '../keyManager';
+import { SignatureService, signedRecordSigningInput, computeRecordId } from '../signatureService';
+import { canonicalize } from '../canonicalJson';
+
+const ec = new EC('secp256k1');
+
+describe('SignatureService.signRecord / verifyRecord', () => {
+  const keyPair = ec.genKeyPair();
+  const publicKey = keyPair.getPublic('hex');
+
+  beforeEach(() => {
+    jest.spyOn(KeyManager, 'getPublicKey').mockResolvedValue(publicKey);
+    jest.spyOn(KeyManager, 'getKeyPairObject').mockResolvedValue(keyPair);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it('builds a well-formed self-issued envelope', async () => {
+    const subject = 'did:web:oxy.so:u:abc123';
+    const record = { displayName: 'Nate', bio: 'builder' };
+
+    const envelope = await SignatureService.signRecord('profile', subject, record);
+
+    expect(envelope.version).toBe(1);
+    expect(envelope.type).toBe('profile');
+    expect(envelope.subject).toBe(subject);
+    expect(envelope.issuer).toBe(subject); // self-issued
+    expect(envelope.record).toEqual(record);
+    expect(envelope.publicKey).toBe(publicKey);
+    expect(envelope.alg).toBe('ES256K-DER-SHA256');
+    expect(typeof envelope.signature).toBe('string');
+    expect(envelope.signature.length).toBeGreaterThan(0);
+    expect(typeof envelope.issuedAt).toBe('number');
+  });
+
+  it('round-trips: a freshly signed record verifies', async () => {
+    const envelope = await SignatureService.signRecord('identity', 'did:web:oxy.so:u:u1', {
+      handle: '@nate',
+      nested: { a: 1, b: [2, 3] },
+    });
+    await expect(SignatureService.verifyRecord(envelope)).resolves.toBe(true);
+  });
+
+  it('signs the canonical JSON of every field except publicKey + signature', async () => {
+    const subject = 'did:web:oxy.so:u:u2';
+    const record = { z: 1, a: 2 };
+    const envelope = await SignatureService.signRecord('profile', subject, record);
+
+    const expectedInput = canonicalize({
+      version: envelope.version,
+      type: envelope.type,
+      subject: envelope.subject,
+      issuer: envelope.issuer,
+      record: envelope.record,
+      issuedAt: envelope.issuedAt,
+    });
+
+    // The helper reproduces exactly that input from the envelope.
+    expect(signedRecordSigningInput(envelope)).toBe(expectedInput);
+    // And it omits publicKey/signature.
+    expect(expectedInput).not.toContain(envelope.publicKey);
+    expect(expectedInput).not.toContain(envelope.signature);
+
+    // The signature verifies against that exact input + the embedded key.
+    await expect(
+      SignatureService.verify(expectedInput, envelope.signature, envelope.publicKey),
+    ).resolves.toBe(true);
+  });
+
+  describe('tamper detection', () => {
+    let envelope: SignedRecordEnvelope;
+
+    beforeEach(async () => {
+      envelope = await SignatureService.signRecord('profile', 'did:web:oxy.so:u:u3', {
+        displayName: 'Original',
+        score: 10,
+      });
+    });
+
+    it('rejects a mutated record', async () => {
+      const tampered: SignedRecordEnvelope = {
+        ...envelope,
+        record: { ...envelope.record, displayName: 'Tampered' },
+      };
+      await expect(SignatureService.verifyRecord(tampered)).resolves.toBe(false);
+    });
+
+    it('rejects a changed subject', async () => {
+      const tampered: SignedRecordEnvelope = { ...envelope, subject: 'did:web:oxy.so:u:evil' };
+      await expect(SignatureService.verifyRecord(tampered)).resolves.toBe(false);
+    });
+
+    it('rejects a changed issuedAt', async () => {
+      const tampered: SignedRecordEnvelope = { ...envelope, issuedAt: envelope.issuedAt + 1 };
+      await expect(SignatureService.verifyRecord(tampered)).resolves.toBe(false);
+    });
+
+    it('rejects verification against an unrelated public key', async () => {
+      const otherKey = ec.genKeyPair().getPublic('hex');
+      const tampered: SignedRecordEnvelope = { ...envelope, publicKey: otherKey };
+      await expect(SignatureService.verifyRecord(tampered)).resolves.toBe(false);
+    });
+  });
+
+  it('throws when no identity is stored', async () => {
+    jest.spyOn(KeyManager, 'getPublicKey').mockResolvedValue(null);
+    await expect(
+      SignatureService.signRecord('identity', 'did:web:oxy.so:u:u4', {}),
+    ).rejects.toThrow(/No identity found/);
+  });
+});
+
+/**
+ * Critical regression guard: the v1 signing input MUST be byte-identical to the
+ * original scheme. Every `identity`/`profile` record already in production was
+ * signed over exactly these bytes, so any change to {@link signedRecordSigningInput}
+ * for v1 would invalidate them all. This locks the exact canonical string.
+ */
+describe('signedRecordSigningInput — v1 byte stability (regression guard)', () => {
+  it('produces the exact original canonical bytes for a v1 record', () => {
+    const input = signedRecordSigningInput({
+      version: 1,
+      type: 'identity',
+      subject: 'did:web:oxy.so:u:u1',
+      issuer: 'did:web:oxy.so:u:u1',
+      record: { handle: '@nate' },
+      issuedAt: 1750000000000,
+    });
+    expect(input).toBe(
+      '{"issuedAt":1750000000000,"issuer":"did:web:oxy.so:u:u1","record":{"handle":"@nate"},"subject":"did:web:oxy.so:u:u1","type":"identity","version":1}',
+    );
+  });
+
+  it('does NOT include any v2 chain fields for a v1 record even if they are passed', () => {
+    const input = signedRecordSigningInput({
+      version: 1,
+      type: 'identity',
+      subject: 'did:web:oxy.so:u:u1',
+      issuer: 'did:web:oxy.so:u:u1',
+      record: { handle: '@nate' },
+      issuedAt: 1750000000000,
+      // These must be ignored by the v1 branch — proving v1 bytes are immutable.
+      seq: 5,
+      prev: 'deadbeef',
+      collection: 'app.oxy.identity',
+      rkey: 'self',
+    });
+    expect(input).not.toContain('seq');
+    expect(input).not.toContain('prev');
+    expect(input).not.toContain('collection');
+    expect(input).not.toContain('rkey');
+    expect(input).toBe(
+      '{"issuedAt":1750000000000,"issuer":"did:web:oxy.so:u:u1","record":{"handle":"@nate"},"subject":"did:web:oxy.so:u:u1","type":"identity","version":1}',
+    );
+  });
+});
+
+describe('SignatureService.signRecordV2 / verifyRecord (v2 hash chain)', () => {
+  const keyPair = ec.genKeyPair();
+  const publicKey = keyPair.getPublic('hex');
+
+  beforeEach(() => {
+    jest.spyOn(KeyManager, 'getPublicKey').mockResolvedValue(publicKey);
+    jest.spyOn(KeyManager, 'getKeyPairObject').mockResolvedValue(keyPair);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  const chain = {
+    seq: 0,
+    prev: null as string | null,
+    collection: 'app.oxy.reputation',
+    rkey: 'rt_1',
+  };
+
+  it('builds a well-formed v2 envelope carrying the chain fields', async () => {
+    const subject = 'did:web:oxy.so:u:abc123';
+    const envelope = await SignatureService.signRecordV2(
+      'reputation_attestation',
+      subject,
+      { points: 25 },
+      chain,
+    );
+
+    expect(envelope.version).toBe(2);
+    expect(envelope.type).toBe('reputation_attestation');
+    expect(envelope.subject).toBe(subject);
+    expect(envelope.issuer).toBe(subject); // self-issued
+    expect(envelope.seq).toBe(0);
+    expect(envelope.prev).toBeNull();
+    expect(envelope.collection).toBe('app.oxy.reputation');
+    expect(envelope.rkey).toBe('rt_1');
+    expect(envelope.publicKey).toBe(publicKey);
+    expect(envelope.alg).toBe('ES256K-DER-SHA256');
+    expect(typeof envelope.signature).toBe('string');
+  });
+
+  it('round-trips: a freshly signed v2 record verifies', async () => {
+    const envelope = await SignatureService.signRecordV2(
+      'validation_verdict',
+      'did:web:oxy.so:u:v1',
+      { verdict: 'approve' },
+      { seq: 3, prev: 'a'.repeat(64), collection: 'app.oxy.validation', rkey: 'req_9' },
+    );
+    await expect(SignatureService.verifyRecord(envelope)).resolves.toBe(true);
+  });
+
+  it('covers the chain fields in the signed bytes (tampering breaks verify)', async () => {
+    const envelope = await SignatureService.signRecordV2(
+      'reputation_attestation',
+      'did:web:oxy.so:u:t1',
+      { points: 8 },
+      chain,
+    );
+
+    await expect(
+      SignatureService.verifyRecord({ ...envelope, seq: 1 }),
+    ).resolves.toBe(false);
+    await expect(
+      SignatureService.verifyRecord({ ...envelope, prev: 'b'.repeat(64) }),
+    ).resolves.toBe(false);
+    await expect(
+      SignatureService.verifyRecord({ ...envelope, collection: 'app.evil' }),
+    ).resolves.toBe(false);
+    await expect(
+      SignatureService.verifyRecord({ ...envelope, rkey: 'other' }),
+    ).resolves.toBe(false);
+  });
+
+  it('a v2 envelope signs over DIFFERENT bytes than the same base fields as v1', async () => {
+    const subject = 'did:web:oxy.so:u:diff';
+    const record = { x: 1 };
+    const v2 = await SignatureService.signRecordV2('profile', subject, record, chain);
+
+    const v1Input = signedRecordSigningInput({
+      version: 1,
+      type: 'profile',
+      subject,
+      issuer: subject,
+      record,
+      issuedAt: v2.issuedAt,
+    });
+    const v2Input = signedRecordSigningInput(v2);
+    expect(v2Input).not.toBe(v1Input);
+    expect(v2Input).toContain('"seq":0');
+    expect(v2Input).toContain('"prev":null');
+    expect(v2Input).toContain('"collection":"app.oxy.reputation"');
+  });
+
+  it('throws when no identity is stored', async () => {
+    jest.spyOn(KeyManager, 'getPublicKey').mockResolvedValue(null);
+    await expect(
+      SignatureService.signRecordV2('identity', 'did:web:oxy.so:u:u4', {}, chain),
+    ).rejects.toThrow(/No identity found/);
+  });
+});
+
+describe('computeRecordId — deterministic content address', () => {
+  const base: SignedRecordEnvelope = {
+    version: 2,
+    type: 'reputation_attestation',
+    subject: 'did:web:oxy.so:u:rid',
+    issuer: 'did:web:oxy.so',
+    record: { points: 25 },
+    issuedAt: 1750000000000,
+    seq: 0,
+    prev: null,
+    collection: 'app.oxy.reputation',
+    rkey: 'rt_1',
+    publicKey: '03oxykey',
+    alg: 'ES256K-DER-SHA256',
+    signature: 'sig-is-not-part-of-the-id',
+  };
+
+  it('is a 64-char lowercase hex SHA-256 digest', async () => {
+    const id = await computeRecordId(base);
+    expect(id).toMatch(/^[0-9a-f]{64}$/);
+  });
+
+  it('is deterministic for identical signing fields', async () => {
+    const a = await computeRecordId(base);
+    const b = await computeRecordId(base);
+    expect(a).toBe(b);
+  });
+
+  it('equals sha256 of the canonical signing input (content address, excludes publicKey/signature)', async () => {
+    const id = await computeRecordId(base);
+    const expected = await SignatureService.hashMessage(signedRecordSigningInput(base));
+    expect(id).toBe(expected);
+    // Changing only signature/publicKey does NOT change the recordId.
+    const sameId = await computeRecordId({
+      ...base,
+      signature: 'totally-different',
+      publicKey: 'different-key',
+    });
+    expect(sameId).toBe(id);
+  });
+
+  it('changes when any signed field changes', async () => {
+    const id = await computeRecordId(base);
+    expect(await computeRecordId({ ...base, seq: 1 })).not.toBe(id);
+    expect(await computeRecordId({ ...base, record: { points: 26 } })).not.toBe(id);
+    expect(await computeRecordId({ ...base, prev: 'a'.repeat(64) })).not.toBe(id);
+  });
+
+  it('a v1 record and a v2 record with the same base fields have different recordIds', async () => {
+    const v1Id = await computeRecordId({
+      version: 1,
+      type: 'profile',
+      subject: 'did:web:oxy.so:u:rid',
+      issuer: 'did:web:oxy.so:u:rid',
+      record: { points: 25 },
+      issuedAt: 1750000000000,
+    });
+    const v2Id = await computeRecordId({
+      version: 2,
+      type: 'profile',
+      subject: 'did:web:oxy.so:u:rid',
+      issuer: 'did:web:oxy.so:u:rid',
+      record: { points: 25 },
+      issuedAt: 1750000000000,
+      seq: 0,
+      prev: null,
+      collection: 'app.oxy.profile',
+      rkey: 'self',
+    });
+    expect(v1Id).not.toBe(v2Id);
+  });
+});